Sas vulnerabilities
We track 3 vulnerabilities in Sas products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2024.
Latest Sas vulnerabilities
- 7.7 High severity
studio: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these file
- 8.8 High severity
studio: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users.
- 8.8 High severity
studio: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for